permdock 0.6.0 → 0.8.0

package/dist/{create-CBMmFie-.d.ts → create-BSNrVuxh.d.ts}

@@ -1,51 +1,81 @@
-import { $n as Delegation, Nn as Decision, T as Policy, ar as Subject, j as PolicyVocabulary, rr as Principal } from "./policy-types-n0uRTsW8.js";
-import { w as Permission } from "./vocabulary-CN8H_9UF.js";
-import { t as Operation } from "./operations-X0VM7F3m.js";
-import { r as PermDock } from "./permdock-SV8ZINYT.js";
-import { m as ApprovalStore } from "./types-BdtSDbBO.js";
-import { t as InstanceOptions } from "./instance-options-BsVpyGIk.js";
+import { Ln as Decision, T as Policy, j as PolicyVocabulary, lr as Subject, rr as Delegation, sr as Principal } from "./policy-types-CCiDRZBH.js";
+import { u as Permission } from "./permission-types-CAY-GU7e.js";
+import { t as Operation } from "./operations-Ci_rT6Uo.js";
+import { a as PermDock } from "./permdock-B6Sf4T_S.js";
+import { m as ApprovalStore } from "./types-B_tiYvk8.js";
+import { t as InstanceOptions } from "./instance-options-B0KXqTrJ.js";
 import { t as RequestContext } from "./request-context-C2_1lchh.js";
-import { n as PermDockWrap } from "./wrap-C5jC6sKI.js";
-import { o as OtelWrap } from "./types-lUlG3TVd.js";
-import { t as DeniedText } from "./denied-text-CiFQNuMV.js";
+import { n as PermDockWrap } from "./wrap-DlJE3gS_.js";
+import { o as OtelWrap } from "./types-DHKPcqzr.js";
+import { t as DeniedText } from "./denied-text-CHNlVInN.js";
+//#region src/agent/step-up.d.ts
+/**
+ * What the user can do to lift a denial: authenticate again with the `acr` and
+ * `maxAge` the failing grants ask for, or activate a role they are eligible
+ * for. A hint for the user; the call is decided again afterwards.
+ */
+type StepUp = {
+  readonly kind: "authentication";
+  readonly acrValues?: readonly string[];
+  readonly maxAge?: number;
+} | {
+  readonly kind: "activation";
+  readonly role: string;
+  readonly scope: string;
+  readonly id: string;
+  readonly within?: Readonly<Record<string, string>>;
+};
+//#endregion
 //#region src/agent/types.d.ts
-/** The part of an operation a tool decision reads; an `OperationMap` entry is one. */
+/**
+ * The part of an operation a tool decision reads; an `OperationMap` entry is
+ * one.
+ */
 type ToolBinding = Pick<Operation, "permission" | "data" | "results"> & Partial<Pick<Operation, "name" | "meta">>;
 type ToolMap = Readonly<Record<string, ToolBinding>>;
 /**
  * The models an agent may call, by model id (`'openai/gpt-5'`), each bound to
- * the permission that grants it. An instance permission is decided on the
- * row `{ id }`.
+ * the permission that grants it. An instance permission is decided on the row
+ * `{ id }`.
  */
 type ModelMap = Readonly<Record<string, Permission>>;
-/** The options `permdock/ai-sdk`, `permdock/openai`, `permdock/claude-agent` and `permdock/eve` share. */
+/**
+ * The options `permdock/ai-sdk`, `permdock/openai`, `permdock/claude-agent` and
+ * `permdock/eve` share.
+ */
 type AgentAdapterOptions<TContext, TUser = unknown> = InstanceOptions & {
   /** The user, or a full `Subject` (core then skips `policy.subject`). */
   readonly subject: (context: TContext) => TUser | Subject | Promise<TUser | Subject>;
   readonly actor?: (context: TContext) => unknown;
   readonly delegation?: (context: TContext) => Delegation | undefined | Promise<Delegation | undefined>;
   readonly tenant?: string | ((context: TContext) => string | undefined | Promise<string | undefined>);
-  /** The tools the agent may call, by tool name: the map `defineOperations` returns. */
+  /**
+   * The tools the agent may call, by tool name: the map `defineOperations`
+   * returns.
+   */
   readonly operations: ToolMap;
   /**
-   * The model gate. Absent: the adapter never checks a model. Present: a
-   * model id it does not name is denied.
+   * The model gate. Absent: the adapter never checks a model. Present: a model
+   * id it does not name is denied.
    */
   readonly models?: ModelMap;
   readonly store?: ApprovalStore;
   /**
-   * Tools `operations` does not name. `'deny'` (default) denies them.
-   * `'allow'` leaves them to the runtime's own approval.
+   * Tools `operations` does not name. `'deny'` (default) denies them. `'allow'`
+   * leaves them to the runtime's own approval.
    */
   readonly unmapped?: "deny" | "allow";
   /**
-   * Request values merged into `subject.context`, under `policy.context`.
-   * Only values the server derived belong here, never model output.
+   * Request values merged into `subject.context`, under `policy.context`. Only
+   * values the server derived belong here, never model output.
    */
   readonly context?: (context: TContext) => RequestContext | undefined | Promise<RequestContext | undefined>;
   /** `(permdock) => withOtel(permdock, options)` from `permdock/otel`. */
   readonly otel?: OtelWrap;
-  /** Wraps each instance after `otel`; build it with `wrapPermDock` to cover derived instances. */
+  /**
+   * Wraps each instance after `otel`; build it with `wrapPermDock` to cover
+   * derived instances.
+   */
   readonly wrap?: PermDockWrap;
   /** Replaces the denial reason or approval summary text; nothing else. */
   readonly deniedText?: DeniedText;
@@ -64,6 +94,11 @@ type ToolVerdict = {
   }> | null;
   readonly permission: Permission | undefined;
   readonly reason: string;
+  /**
+   * What the user can do to lift the denial; set only by an adapter with
+   * step-ups on (`permdock/ai-sdk` `stepUp`).
+   */
+  readonly stepUp?: StepUp;
 } | {
   readonly outcome: "approval-required";
   readonly decision: Extract<Decision, {
@@ -87,9 +122,15 @@ type DecideToolOptions = {
 //#endregion
 //#region src/agent/create.d.ts
 type AgentPermDockOptions<TContext, TUser = unknown> = AgentAdapterOptions<TContext, TUser>;
-/** What one operation call decides: granted with the loaded row, denied with the text a model reads, or parked for approval. */
+/**
+ * What one operation call decides: granted with the loaded row, denied with the
+ * text a model reads, or parked for approval.
+ */
 type OperationVerdict = ToolVerdict;
-/** `providerOptions` for the Vercel AI Gateway: spend and usage attributed to the caller. */
+/**
+ * `providerOptions` for the Vercel AI Gateway: spend and usage attributed to
+ * the caller.
+ */
 type GatewayOptions = {
   readonly gateway: {
     readonly user?: string;
@@ -103,29 +144,41 @@ type GatewayOptions = {
  * their runtime calls.
  */
 type AgentPermDock<TContext, V extends PolicyVocabulary = PolicyVocabulary> = {
-  /** One instance per context object while a call is in flight; later calls re-read the subject. */
+  /**
+   * One instance per context object while a call is in flight; later calls
+   * re-read the subject.
+   */
   readonly getPermDock: (context: TContext) => Promise<PermDock<V>>;
   /**
-   * Decides operation `name` on `input`: loads the row through the
-   * operation's `data`, validates it, decides and resumes an approval. Never
-   * throws; an operation `operations` does not name is denied.
+   * Decides operation `name` on `input`: loads the row through the operation's
+   * `data`, validates it, decides and resumes an approval. Never throws; an
+   * operation `operations` does not name is denied.
    */
   readonly decideOperation: (name: string, input: unknown, context: TContext, options?: DecideToolOptions) => Promise<OperationVerdict>;
-  /** Operation names the subject could be granted for some row; a listing hint, never a decision. */
+  /**
+   * Operation names the subject could be granted for some row; a listing hint,
+   * never a decision.
+   */
   readonly allowedOperations: (context: TContext) => Promise<ReadonlySet<string>>;
   /** The approval token a call would park under, without touching the store. */
   readonly tokenFor: (name: string, input: unknown, context: TContext) => Promise<string | undefined>;
-  /** Decides whether the subject may call model `modelId`. A model `models` does not name is denied. */
+  /**
+   * Decides whether the subject may call model `modelId`. A model `models` does
+   * not name is denied.
+   */
   readonly decideModel: (modelId: string, context: TContext) => Promise<Decision>;
   /** The ids in `models` the subject is granted, in declaration order. */
   readonly permittedModels: (context: TContext) => Promise<readonly string[]>;
   /**
-   * The rows of an operation's output the subject may see, by the
-   * operation's `results` permission. Without `results` the rows come back
-   * unchanged; an operation `operations` does not name returns none.
+   * The rows of an operation's output the subject may see, by the operation's
+   * `results` permission. Without `results` the rows come back unchanged; an
+   * operation `operations` does not name returns none.
    */
   readonly filterResults: <T>(name: string, rows: readonly T[], context: TContext) => Promise<T[]>;
-  /** `providerOptions.gateway` with the principal as `user` and the tenant and actor as tags. */
+  /**
+   * `providerOptions.gateway` with the principal as `user` and the tenant and
+   * actor as tags.
+   */
   readonly gatewayOptions: (context: TContext) => Promise<GatewayOptions>;
 };
 /**
@@ -135,4 +188,4 @@ type AgentPermDock<TContext, V extends PolicyVocabulary = PolicyVocabulary> = {
  */
 declare function createPermDock<TContext, TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, given: AgentPermDockOptions<TContext, TUser>): AgentPermDock<TContext, V>;
 //#endregion
-export { createPermDock as a, ModelMap as c, OperationVerdict as i, ToolBinding as l, AgentPermDockOptions as n, AgentAdapterOptions as o, GatewayOptions as r, DecideToolOptions as s, AgentPermDock as t, ToolMap as u };
+export { createPermDock as a, ModelMap as c, StepUp as d, OperationVerdict as i, ToolBinding as l, AgentPermDockOptions as n, AgentAdapterOptions as o, GatewayOptions as r, DecideToolOptions as s, AgentPermDock as t, ToolMap as u };

package/dist/{create-B30OMUOJ.d.ts → create-BVq1lNQE.d.ts}

@@ -1,14 +1,14 @@
-import { Ln as DeniedDecision, Mn as ApprovalRequiredDecision, T as Policy, ar as Subject, j as PolicyVocabulary, rr as Principal, zn as GrantedDecision } from "./policy-types-n0uRTsW8.js";
-import { t as Operation } from "./operations-X0VM7F3m.js";
-import { i as PermDockOptions, p as PrincipalSource, r as PermDock } from "./permdock-SV8ZINYT.js";
-import { m as ApprovalStore, p as ApprovalStatus } from "./types-BdtSDbBO.js";
-import { n as ApprovalErrorCode } from "./errors-BWXBMaKK.js";
-import { t as ApprovalPrompt } from "./approval-prompt-DvSSPQJX.js";
+import { In as ApprovalRequiredDecision, T as Policy, Un as GrantedDecision, Vn as DeniedDecision, j as PolicyVocabulary, lr as Subject, sr as Principal } from "./policy-types-CCiDRZBH.js";
+import { t as Operation } from "./operations-Ci_rT6Uo.js";
+import { _ as PrincipalSource, a as PermDock, o as PermDockOptions } from "./permdock-B6Sf4T_S.js";
+import { m as ApprovalStore, p as ApprovalStatus } from "./types-B_tiYvk8.js";
+import { n as ApprovalErrorCode } from "./errors-CHwoRRpB.js";
+import { t as ApprovalPrompt } from "./approval-prompt-PYagyQUj.js";
 //#region src/chat/subject.d.ts
 /**
- * The platform user behind a chat message or action. Fill it only from an
- * event whose platform signature the transport verified; a body field or a
- * model argument is never an author.
+ * The platform user behind a chat message or action. Fill it only from an event
+ * whose platform signature the transport verified; a body field or a model
+ * argument is never an author.
  */
 type ChatAuthor = {
   /** The chat platform (`slack`, `teams`, `discord`, …). */
@@ -18,7 +18,10 @@ type ChatAuthor = {
   /** The workspace, team or tenant id on the platform. */
   readonly workspace?: string;
 };
-/** The principal a chat author's identity link names, as the `PrincipalSource` returns it. */
+/**
+ * The principal a chat author's identity link names, as the `PrincipalSource`
+ * returns it.
+ */
 type ChatPrincipal = Principal;
 type SubjectFromChatOptions = {
   /** Resolves the author through `principalByIdentity({ kind: 'chat', … })`. */
@@ -26,16 +29,22 @@ type SubjectFromChatOptions = {
 };
 declare function isChatAuthor(value: unknown): value is ChatAuthor;
 /**
- * The subject a chat author acts as: the principal its identity link
- * names, or anonymous when there is no link. Never throws.
+ * The subject a chat author acts as: the principal its identity link names, or
+ * anonymous when there is no link. Never throws.
  */
 declare function subjectFromChat(author: ChatAuthor | null | undefined, options: SubjectFromChatOptions): Promise<Subject>;
 //#endregion
 //#region src/chat/create.d.ts
 type ChatPermDockOptions = PermDockOptions & {
-  /** Resolves chat authors through `principalByIdentity`; also the instance's principal source. */
+  /**
+   * Resolves chat authors through `principalByIdentity`; also the instance's
+   * principal source.
+   */
   readonly principals: PrincipalSource;
-  /** Where approval requests open and resolve. Without it an approval-required command only reports the decision. */
+  /**
+   * Where approval requests open and resolve. Without it an approval-required
+   * command only reports the decision.
+   */
   readonly store?: ApprovalStore;
 };
 /** What a protected command's handler receives once the author is granted. */
@@ -56,12 +65,21 @@ type ChatCommandResult<T> = {
 } | {
   readonly outcome: "approval-required";
   readonly decision: ApprovalRequiredDecision;
-  /** The open request to deliver to approvers; `null` without an approval store. */
+  /**
+   * The open request to deliver to approvers; `null` without an approval
+   * store.
+   */
   readonly prompt: ApprovalPrompt | null;
 };
-/** A command guarded by `protect`. Never throws for a refusal; the handler's own errors propagate. */
+/**
+ * A command guarded by `protect`. Never throws for a refusal; the handler's own
+ * errors propagate.
+ */
 type ChatCommand<TInput, T> = (author: ChatAuthor | null | undefined, input: TInput) => Promise<ChatCommandResult<T>>;
-/** A verdict from a chat button or reaction, by approval request `id`; the token never leaves the server. */
+/**
+ * A verdict from a chat button or reaction, by approval request `id`; the token
+ * never leaves the server.
+ */
 type ChatAction = {
   readonly approval: string;
   readonly status: "approved" | "rejected";
@@ -76,24 +94,27 @@ type ChatActionResult = {
   readonly cause: ApprovalErrorCode | "invalid-action";
 };
 /**
- * The runtime-neutral chat contract: commands decided as the linked
- * principal of a verified chat author, and approval verdicts from chat
- * actions. `permdock/chat-sdk` implements it for Chat SDK bots.
+ * The runtime-neutral chat contract: commands decided as the linked principal
+ * of a verified chat author, and approval verdicts from chat actions.
+ * `permdock/chat-sdk` implements it for Chat SDK bots.
  */
 type ChatPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
-  /** The instance for `author`; anonymous, and so denying, when the author is unlinked. */
+  /**
+   * The instance for `author`; anonymous, and so denying, when the author is
+   * unlinked.
+   */
   readonly getPermDock: (author: ChatAuthor | null | undefined) => Promise<PermDock<V>>;
   /**
-   * Guards `handler` with `operation`: loads the row through the
-   * operation's `data`, decides as the author, and on `approval-required`
-   * opens one request per author, permission and row. The handler runs only
-   * when granted; an approved request runs it once.
+   * Guards `handler` with `operation`: loads the row through the operation's
+   * `data`, decides as the author, and on `approval-required` opens one request
+   * per author, permission and row. The handler runs only when granted; an
+   * approved request runs it once.
    */
   readonly protect: <TInput, T>(operation: Operation<TInput>, handler: (context: ChatCommandContext<TInput, V>) => T | Promise<T>) => ChatCommand<TInput, T>;
   /**
-   * Resolves approval request `action.approval` as `author`. The author must
-   * be linked and an eligible, distinct approver; the request's requester
-   * never approves their own request.
+   * Resolves approval request `action.approval` as `author`. The author must be
+   * linked and an eligible, distinct approver; the request's requester never
+   * approves their own request.
    */
   readonly resolveAction: (author: ChatAuthor | null | undefined, action: ChatAction) => Promise<ChatActionResult>;
 };

package/dist/{create-D_NmPOdH.d.ts → create-CM1FciYG.d.ts}

@@ -1,10 +1,10 @@
-import { Nn as Decision, Pn as Denial, Rt as Instant, T as Policy, dt as TokenVerifier, j as PolicyVocabulary, qt as AuthEvent, rr as Principal, ut as TokenSigner } from "./policy-types-n0uRTsW8.js";
-import { w as Permission } from "./vocabulary-CN8H_9UF.js";
-import { i as PermDockOptions, p as PrincipalSource, r as PermDock, t as DecideOptions } from "./permdock-SV8ZINYT.js";
-import { m as ApprovalStore } from "./types-BdtSDbBO.js";
-import { a as AutomationSource } from "./automation-BNM3TtDo.js";
-import { n as ApprovalWaiter } from "./waiter-B986w1oK.js";
-import { n as RunAutomation, r as RunBinding } from "./run-ticket-DocwaTKn.js";
+import { Ln as Decision, Rn as Denial, Rt as Instant, T as Policy, Zt as AuthEvent, dt as TokenVerifier, j as PolicyVocabulary, sr as Principal, ut as TokenSigner } from "./policy-types-CCiDRZBH.js";
+import { u as Permission } from "./permission-types-CAY-GU7e.js";
+import { _ as PrincipalSource, a as PermDock, n as DecideOptions, o as PermDockOptions } from "./permdock-B6Sf4T_S.js";
+import { m as ApprovalStore } from "./types-B_tiYvk8.js";
+import { a as AutomationSource } from "./automation-DqEoWHBc.js";
+import { n as ApprovalWaiter } from "./waiter-Bu9zAlE0.js";
+import { i as RunBinding, r as RunAutomation } from "./run-ticket-DbWI9f99.js";
 //#region src/workflow/create.d.ts
 type WorkflowPermDockOptions = PermDockOptions & {
   /** Signs the run tickets `start` mints. */
@@ -15,7 +15,10 @@ type WorkflowPermDockOptions = PermDockOptions & {
   readonly principals: PrincipalSource;
   /** The live automation records, read by `start` and on every `getPermDock`. */
   readonly automations: AutomationSource;
-  /** Where `awaitApproval` opens and resumes requests; the same option name as every other adapter. */
+  /**
+   * Where `awaitApproval` opens and resumes requests; the same option name as
+   * every other adapter.
+   */
   readonly store?: ApprovalStore;
   /** Suspends `awaitApproval` until a request is decided. */
   readonly waiter?: ApprovalWaiter;
@@ -36,7 +39,10 @@ type AutomationOptions = {
   readonly caller?: PermDock;
   /** The row `run` is decided on, when it is an instance permission. */
   readonly row?: unknown;
-  /** The event that started the run, as JSON. Kept in `subject.context.trigger`; never a grant. */
+  /**
+   * The event that started the run, as JSON. Kept in `subject.context.trigger`;
+   * never a grant.
+   */
   readonly trigger?: Readonly<Record<string, unknown>>;
   /** The run id (`jti`); a fresh UUID when absent. */
   readonly id?: string;
@@ -55,7 +61,10 @@ type StartAutomationResult = {
   readonly denials: readonly Denial[];
 };
 type AwaitApprovalOptions = DecideOptions & {
-  /** The resource the approval request names; defaults to the permission's resource and the row's `id`. */
+  /**
+   * The resource the approval request names; defaults to the permission's
+   * resource and the row's `id`.
+   */
   readonly resource?: {
     readonly type: string;
     readonly id?: string;
@@ -66,30 +75,29 @@ type AwaitApprovalOptions = DecideOptions & {
 };
 type WorkflowPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
   /**
-   * Starts a run of the automation `id` and returns its run ticket. Denied
-   * when the automation is unknown or revoked (`validation`) or when the
-   * caller is not granted its `run` permission.
+   * Starts a run of the automation `id` and returns its run ticket. Denied when
+   * the automation is unknown or revoked (`validation`) or when the caller is
+   * not granted its `run` permission.
    */
   readonly start: (id: string, options?: AutomationOptions) => Promise<StartAutomationResult>;
   /**
-   * The PermDock of a run, rebuilt from its ticket: the principal loaded
-   * live, narrowed to the automation's permissions and to any policy
-   * delegation to `actor('automation')`. A changed, revoked or unknown
-   * automation, or a publisher who is gone, gives an anonymous instance
-   * that denies everything.
+   * The PermDock of a run, rebuilt from its ticket: the principal loaded live,
+   * narrowed to the automation's permissions and to any policy delegation to
+   * `actor('automation')`. A changed, revoked or unknown automation, or a
+   * publisher who is gone, gives an anonymous instance that denies everything.
    */
   readonly getPermDock: (ticket: string) => Promise<PermDock<V>>;
   /**
-   * Decides `permission`; on `approval-required` opens a request, waits on
-   * the `waiter`, then rebuilds the run from its ticket and decides again
-   * with the token. The second decision reads the publisher's rights as of
-   * then, so a demotion while waiting denies.
+   * Decides `permission`; on `approval-required` opens a request, waits on the
+   * `waiter`, then rebuilds the run from its ticket and decides again with the
+   * token. The second decision reads the publisher's rights as of then, so a
+   * demotion while waiting denies.
    */
   readonly awaitApproval: (ticket: string, permission: Permission, data?: unknown, options?: AwaitApprovalOptions) => Promise<Decision>;
   /**
-   * The first half of `awaitApproval`, for runners that wait outside the
-   * call: decides, and on `approval-required` opens the request and returns
-   * the decision with its token.
+   * The first half of `awaitApproval`, for runners that wait outside the call:
+   * decides, and on `approval-required` opens the request and returns the
+   * decision with its token.
    */
   readonly openApproval: (ticket: string, permission: Permission, data?: unknown, options?: AwaitApprovalOptions) => Promise<Decision>;
   /**
@@ -100,10 +108,10 @@ type WorkflowPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
   readonly resumeApproval: (ticket: string, permission: Permission, token: string, data?: unknown, options?: AwaitApprovalOptions) => Promise<Decision>;
 };
 /**
- * Creates the PermDock for durable runs of published automations. A run
- * acts as the automation's principal with that principal's rights at each
- * step, narrowed to the automation's operations; the trigger is recorded
- * and never grants.
+ * Creates the PermDock for durable runs of published automations. A run acts as
+ * the automation's principal with that principal's rights at each step,
+ * narrowed to the automation's operations; the trigger is recorded and never
+ * grants.
  */
 declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, given: WorkflowPermDockOptions): WorkflowPermDock<V>;
 //#endregion

package/dist/{create-CGm28gyI.js → create-Cq4Uox0f.js}

@@ -1,10 +1,10 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { a as deniedFor } from "./where-scope-C9vfEphl.js";
-import { c as withApp } from "./permdock-BrAscV28.js";
-import { t as composeWraps } from "./wrap-gX61EtpB.js";
-import { r as instanceOptions } from "./build-instance-Bu_eDqYw.js";
-import { n as createAgentKernel } from "./kernel-D0NVb1cK.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { o as deniedFor } from "./where-scope-DlCdCM_8.js";
+import { l as withApp } from "./permdock-L-_I_3zP.js";
+import { t as composeWraps } from "./wrap-B2wziJI_.js";
+import { r as instanceOptions } from "./build-instance-CNWaYJyr.js";
+import { n as createAgentKernel } from "./kernel-C-fYydV2.js";
 //#region src/agent/create.ts
 function modelRow(modelId) {
 	return { id: modelId };
@@ -34,8 +34,11 @@ function decideModelOn(permdock, models, modelId, adapter) {
 		return deniedFor(permission, "closure-error");
 	}
 }
-/** Builds the agent contract and its kernel for an adapter named `adapter`. */
-function agentRuntime(policy, options, adapter) {
+/**
+* Builds the agent contract and its kernel for an adapter named `adapter`;
+* `runtime.stepUp` sets `stepUp` on denied verdicts.
+*/
+function agentRuntime(policy, options, adapter, runtime = {}) {
 	const kernel = createAgentKernel(policy, {
 		...compact({
 			actor: options.actor,
@@ -44,7 +47,8 @@ function agentRuntime(policy, options, adapter) {
 			store: options.store,
 			context: options.context,
 			wrap: composeWraps(options.otel, options.wrap),
-			deniedText: options.deniedText
+			deniedText: options.deniedText,
+			stepUp: runtime.stepUp
 		}),
 		...instanceOptions(options),
 		subject: options.subject,

package/dist/{create-DCF2SvoT.js → create-_noSrY1T.js}

@@ -1,15 +1,15 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { n as problemDetails } from "./problem-details-cn5X30gZ.js";
-import { c as listPermissions } from "./permission-registry-Br4jSNVi.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { n as problemDetails } from "./problem-details-CLDgX1KV.js";
+import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
 import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
-import { c as withApp, i as challengeScope } from "./permdock-BrAscV28.js";
-import { r as hasCredentials } from "./http-BBoKefeS.js";
-import { i as decisionResponse, o as notFoundProblem, s as problemFromDecision, t as ANONYMOUS, u as unauthenticatedProblem } from "./problem-CTviyH5L.js";
-import { n as resolveOrNull } from "./build-instance-Bu_eDqYw.js";
-import { n as applyApprovalResume, o as evaluationsHandler, u as InvalidSignatureError } from "./evaluations-beAooV0n.js";
-import { n as tenantScope, t as actorFrom } from "./adapter-context-CRhqyzCk.js";
-import { n as requestContext, t as buildReportingInstance } from "./request-context-C81Pip9n.js";
+import { i as challengeScope, l as withApp } from "./permdock-L-_I_3zP.js";
+import { r as hasCredentials } from "./http-DKLXrFGk.js";
+import { a as decisionResponse, c as problemFromDecision, d as unauthenticatedProblem, s as notFoundProblem, t as ANONYMOUS } from "./problem-BVLHFK33.js";
+import { n as resolveOrNull } from "./build-instance-CNWaYJyr.js";
+import { _ as LOAD_FAILED, l as InvalidSignatureError, n as applyApprovalResume, o as evaluationsHandler } from "./evaluations-IBceAeKT.js";
+import { n as tenantScope, t as actorFrom } from "./adapter-context-CIQpQxbE.js";
+import { n as requestContext, t as buildReportingInstance } from "./request-context-C25ilqiJ.js";
 //#region src/server/kernel-problems.ts
 const NOT_DELEGATED = freezeDeep({
 	outcome: "denied",
@@ -19,14 +19,6 @@ const NOT_DELEGATED = freezeDeep({
 	}],
 	alternatives: []
 });
-const LOAD_FAILED = freezeDeep({
-	outcome: "denied",
-	denials: [{
-		role: null,
-		reason: "validation"
-	}],
-	alternatives: []
-});
 /** The `403` for a loader that threw: the check fails closed, as on MCP. */
 function loadFailedProblem(permission) {
 	const key = permission?.key ?? "the route";
@@ -36,7 +28,10 @@ function loadFailedProblem(permission) {
 		permission: permission?.key
 	})), LOAD_FAILED);
 }
-/** The `403` `insufficient_scope` for a token that holds none of a route's OAuth scopes. */
+/**
+* The `403` `insufficient_scope` for a token that holds none of a route's OAuth
+* scopes.
+*/
 function scopeProblem(permission, subject, credentials, scope) {
 	return permission === null ? decisionResponse(problemDetails(compact({
 		decision: NOT_DELEGATED,
@@ -242,8 +237,7 @@ function createPermDock(policy, given) {
 	};
 	const connection = async (request, connectionOptions = {}, scope) => {
 		const { tenant } = scope ?? await tenantScope(options.tenant, request);
-		const { openConnection } = await import("./connection-DjhIJSs2.js");
-		return openConnection({
+		return (await import("./connection-B72dg5Q2.js")).openConnection({
 			open: async () => (await build(request, { tenant })).permdock,
 			rebuild: async () => (await instanceFor(await freshSubject(request), tenant)).permdock,
 			tenant,